Top Risks

• proxy permission allows all browser traffic to be routed through sverchtun.store (RU-hosted unknown server)
• install URL hijack opens sverchtun.store on install — classic low-quality VPN monetization/tracking pattern
• Privacy policy is Google's generic policy — no scope to this extension, admits data collection and 3rd-party sharing
• Free-webmail dev (gmail), no developer name, no verified publisher — zero accountability
• Tiny install base (80) with HIGH-tier permission is tail-attack-surface anomaly

Evidence

• proxy_permission manifest proxy declared — can intercept and redirect all browser HTTP/HTTPS traffic to developer-controlled server.
• install_url_hijack store onInstalled opens https://sverchtun.store/ — third-party RU domain, monetization/tracking risk.
• js_external_host_ru crx Only external JS host is sverchtun.store (RU geolocation). Proxy endpoints likely same domain.
• generic_privacy_policy store Privacy URL is Google account policy — scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_no_devname store Developer email ekugabezu505@gmail.com, no developer name listed, no verified publisher badge.
• small_install_high_perm api 80 installs with proxy (HIGH-tier) flagged as install_perm_anomaly.small_install_high_perm=true.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening declared.
• cve_findings_empty crx No CVEs found in bundled libraries; cve_findings_raw is empty.

Permissions Breakdown

• proxy high Allows rerouting all browser traffic through attacker-controlled proxy server.

Pillar Scores

Bookkeeping